The present invention relates to the field of identity verification. Specifically, the invention is directed to a system and method of providing system integrity and audit capabilities to a positive identification system by including biometric user authentication. More particularly, the system and the method utilizes an automated biometric comparison system to limit access to the identification database and the information contained therein to personnel who are authorized to do so. Useful biometrics include fingerprints, retinal scans as well as thermal images and voiceprints. However, due to the unavailability of low-cost biometric comparison technology that can readily identify the required percentage of system users, the disclosed system includes a personal identification number (PIN) back-up user authentication system and method.
Positive identity verification is critical in many type of transaction and security applications. For example, signatures, fingerprints or images of faces are compared to establish or verify the identity of an individual. Creation of fraudulent identities or the misrepresentation of an individual""s identity can result in fraudulent transactions and the breach of security systems. At present, such positive identification means as driver""s licenses, picture identification cards, hand-written signatures, personal identification numbers, fingerprints, retinal scans, voice prints and other ways of uniquely identifying personal characteristics are used. However, these prior art methods of identity verification exhibit one or more of the following deficiencies: 1) they do not offer sufficient reliability for most positive personal identification applications; 2) the technology required for their implementation is too expensive for wholesale adoption by entire industries; 3) they do not offer ease of use, which is critical for most applications of personal identification; 4) the technology required to implement them in a wide-scale manner is not yet mature enough to guarantee sufficient reliability; 5) the recurring cost of using technology is too high for most applications of personal identification; 6) the data used for identity verification is not maintained in a secure manner and is almost universally held by the person presenting it as the form of verification, thereby allowing for fraudulent alteration of the verification data; 7) processes for building accurate verification databases for wide-spread use are impractical; and 8) the process of verification does not include sufficient steps to ensure that the individual responsible for identity verification is accountable to ensure that identity verification is accurately performed.
One system which relies on positive identity verification for transaction is the credit/debit and charge card system. Credit cards are an increasingly popular means for consumers to complete transactions. However, part of the costs incurred for the convenience of using credit cards is the burgeoning growth of credit card fraud. Because there are trillions of dollars of credit card transactions made each year, which depend on the fact that the person presenting the form of payment is actually the person having the legal right to use the underlying account, even a small percentage of fraudulent transactions results in billions of lost dollars. The cost of this fraud is paid for, indirectly, by consumers in the form of higher credit card interest rates and fees and, in part, by merchants accepting such credit cards in the form of higher transaction commissions.
Methods used to combat fraud have been the use of holographic images on cards, the need for a validation requester to obtain transaction approval, the encoding of cardholder information on magnetic strips on the back of the card, as well as signature verification. However, one of the underlying deficiencies of the prior art identification systems is that they all rely, in some manner, on information encoded on the credit card being presented. While some of these references include sophisticated encryption algorithms, the fact remains that giving access to the information to the card users lends itself to the potential for reverse engineering and overcoming even the most sophisticated of encryption means.
In recent past, Citibank introduces a credit card with a digital likeness of the authorized user provided on the card itself. The photographic image on the Citibank card resulted in an initial drop in fraud in the New York test market estimated as high as 67 percent. However, the Citibank photo card system, like other forms of identity verification that are distributed to the public, will eventually be defeated by sophisticated counterfeiting.
An additional difficulty with most prior art verification methods is that they all require the use of a special credit card incorporating some form of identification means. Thus, in order for their use to gain widespread acceptance, replacement of existing credit cards and credit card manufacturing equipment must be accomplished.
The disclosed invention offers a number of advances over prior art identity verification systems and methods, which overcome many of the limitations found in such prior art systems. The first, and perhaps the most significant, advantage of the disclosed invention is that the positive identification system stores the verification data at a remote site and thereby does not give criminals access to the identity verification medium. This is significant in that any time a potential counterfeiter is afforded the opportunity to access the verification medium, there is the potential that the medium can be corrupted, regardless of the level of security sophistication incorporated into the system.
A second, and again significant, advantage of the disclosed invention is that the system is completely independent of the users the system is designed to positively identify. For example, the system is independent of credit cards account numbers, checking account number and the like. Thus, for example, the disclosed invention does not require the modification or replacement of existing credit cards, which would be an almost insurmountable task. Furthermore, the segregation of the identity verification medium from the users themselves allows the system disclosed herein to be used in conjunction with any number of credit card accounts, checking accounts or other applications where it is critical to determine that a person is who he or she purports him or herself to be.
The present invention is a system and method of providing access integrity and audit capabilities to a positive identification system by including biometric user authentication in the system and method. The system comprises a point of identification terminal having a means for inputting a biometric access authority information unit from a system user, a means for inputting identifying information presented by a particular individual, at least one database storage and retrieval site having stored therein a plurality of digital image data unique to persons to be identified and a biometric access authority information unit database, including biometric data associated with authorized system users. The system also comprises a means for exchanging biometric, identifying and other data between the point of identification terminal and the database site. In addition to authenticating system users, the database site also includes a means of validating that a point of identification terminal seeking to exchange data with the site is authorized to do so.
When a query is initiated from a point of identification terminal, the system user must input a biometric access authority information unit associated with that user into the point of identification terminal. In one preferred embodiment, the biometric access authority information unit comprises one or more of the system user""s fingerprints, which are read by a fingerprint scanner included in or connected to the point of identification terminal. The input biometric access authority information unit is then transmitted to the remote database site.
At the database site, the system receives the biometric access authority information unit and searches the biometric access authority information unit database to determine if a match exists between the received biometric access authority information unit and a stored biometric access authority information unit. If a match exists, then the system user is permitted to input information presented by a person to be identified at the point of identification terminal into the system.
The point of identification terminal then transmits the information presented at the point of identification terminal to the remote database site, where the system searches the database of digital photographic images of persons to be identified and retrieves any photographic information associated with the identifying information transmitted to the remote database site. The retrieved information is returned to the point of identification terminal where it is displayed on a display device.
Finally, the system incorporates a means for verifying that system user has adequately verified that the digital image displayed on the display device matches physical, biometric information provided by the person to be identified at the point of identification terminal.